The Identity Breach You Didn’t Know You Had: Google Workspace

Attackers are increasingly treating Google Workspace inboxes as an identity control plane rather than just email, abusing session tokens, OAuth grants, device code flows, and native mailbox features (forwarding, rules, calendar invites) to bypass MFA, persist, and pivot across SaaS ecosystems; defenders must shift from email-focused controls to identity telemetry and behavior-based detection such as ITDR.